Free Check
What can anyone on the internet see in your app?
Paste your app’s address. The Check reads what a browser downloads and gives you a Leak Score from A to F, with a card you can share once you’ve fixed it.
Daryl Shield is in early access. The free Check isn’t open yet: leave your app’s address and we’ll email you when it is.
Leak Score
A to F, and what each grade means
- ANothing a browser downloads gives away more than it should.
- BSmall issues, such as missing security headers or an exposed source map.
- CSomething worth fixing soon, such as a public storage bucket with a sensitive name.
- DA likely exposure, such as signs that tables may be readable without signing in.
- FA key that bypasses your database rules is in the code your app ships to every visitor.
What the Check does
Passive, polite and limited
- What it reads
- Your pages’ HTML, the JavaScript bundles a browser downloads, response headers, source maps if they are public, and storage URLs referenced in that code.
- What it looks for
- Whether a public key or a service-role key ships in your bundle, signs that rules are off, public buckets, missing headers, and leaked secrets.
- What it never does
- Read rows, list your tables (not even the API’s schema root), sign in, or send anything that changes data.
- After you verify
- Once you prove you own the app, Daryl can say whether each table is readable and roughly how many rows it holds. Never what is in them.
- Limits
- 5 Checks per network per hour and 3 per domain per day before you verify. It identifies itself, honours robots.txt and /.well-known/daryl-optout, and re-checks every redirect against private addresses.
Verify
Prove you own the app
- 01DNS recordAdd a TXT record we give you to your domain.
- 02Well-known filePut a short file we give you at /.well-known/daryl-verify.txt on your site.
- 03SupabaseConnect your Supabase project with read-only access. Nothing changes.
Share card
Show the grade you earned
A
Example
your-app.com
Leak Score C → A after fixes
Verified by Daryl